modelcontextprotocol/php-sdk
Watch
1
0
Fork
You've already forked php-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(adr): scope OAuth to resource server, not authorization server (#382)

Browse source 
Record ADR 0001: the MCP server is an OAuth 2.1 Resource Server that MAY
delegate to an upstream authorization server, and will NOT issue tokens or
act as an Identity Provider. Gives a single citable ruling to decline the
recurring "native authorization server" PRs (e.g. #373).

Also remove the surface signal that invites them: reframe the
OAuthProxyMiddleware class docblock to lead with its delegation intent and
state explicit non-goals (never mints/signs/stores/rotates tokens), and add
a "Scope" section to docs/authorization.md describing the three OAuth roles
and what the SDK does not do.

No behavior change — docblock, docs, and ADR only.
This commit is contained in:
Antoine Bluchet 2026-07-06 00:37:19 +02:00 • committed by GitHub
commit 1587ac5bd2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 138 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

10
adr/README.md Normal file
View file

@ -0,0 +1,10 @@
# Architecture Decision Records
This directory holds Architecture Decision Records (ADRs): short documents that capture a
significant architectural decision, the context that led to it, and its consequences. They
exist so a decision can be cited once and referenced thereafter — for example, when declining
a pull request that conflicts with an accepted decision.
## Records
- [0001 — The MCP server is an OAuth Resource Server, not an Authorization Server](0001-oauth-authorization-server-out-of-scope.md)